.vscode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .vscode (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that exposes GroupDocs.Watermark as AI-callable tools for Claude, Cursor, GitHub Copilot, and other MCP agents.
<!-- TODO(manual): record 30s demo per improvement-plan M1 --> <!-- Demo -->
<!-- install-buttons:start - generated by install/generate-install-links.ps1; do not edit by hand -->
One-click installs pre-fill every supported setting: edit the placeholder documents folder after install (output defaults to the same folder); an empty GROUPDOCS_LICENSE_PATH runs in evaluation mode - point it at your license to lift limits.
>
More clients - ready-made configs for Claude Code, Codex CLI, Visual Studio 2022, Cursor, Windsurf, Cline, and JetBrains Rider live in install/generated/.<!-- install-buttons:end -->
Requires .NET 10 SDK.
Run directly with `dnx` (recommended — no install step):
dnx GroupDocs.Watermark.Mcp --yesPulls the latest stable release on every invocation. To pin to a specific version (recommended for shared configs and CI), append @<version>:
dnx [email protected] --yesOr install as a global dotnet tool:
dotnet tool install -g GroupDocs.Watermark.Mcp
groupdocs-watermark-mcpOr run via Docker:
docker run --rm -i \
-v $(pwd)/documents:/data \
ghcr.io/groupdocs-watermark/watermark-net-mcp:latestThe underlying GroupDocs engine uses System.Drawing (GDI+) for some operations. When you run the server natively (via dnx or the global dotnet tool) on Linux or macOS, install the native libgdiplus library first:
| Platform | Setup |
|---|---|
| Windows | Nothing — GDI+ is built into the OS. |
| Linux | sudo apt-get install -y libgdiplus libfontconfig1 ttf-mscorefonts-installer |
| macOS | brew install mono-libgdiplus |
| Docker | Nothing — the image already bundles libgdiplus. |
Skipping this on Linux/macOS surfaces as DllNotFoundException: libgdiplus in the tool response. The simplest zero-setup option on Linux/macOS is the Docker image.
| Tool | Description |
|---|---|
AddWatermark | Adds a text watermark (Arial, configurable size + rotation) to a document and saves the watermarked file to storage |
AddImageWatermark | Adds an image watermark (logo, signature scan, stamp) to a document and saves the watermarked file. Configurable opacity + rotation |
SearchWatermarks | Finds existing watermarks (text + image) in a document and returns their details (type, text, page, position, size, rotation) as JSON |
RemoveWatermarks | Removes existing watermarks from a document and saves the cleaned copy. Optional text filter to remove only matching watermarks |
GetDocumentInfo | Returns the file type, page count, and per-page dimensions of a document as JSON — without modifying it |
All tools support PDF, DOCX, XLSX, PPTX, PNG, JPG, VSDX, and 50+ more document and image formats.
Copy any of these into Claude Desktop, Cursor, or GitHub Copilot Chat after the server is connected. The AI agent will pick the right tool and arguments automatically — file names are resolved against GROUPDOCS_MCP_STORAGE_PATH.
The MCP server itself is MIT; the underlying GroupDocs.Watermark engine requires a license for production use. Without one the server runs in evaluation mode:
There are two ways to license the server.
License file — point GROUPDOCS_LICENSE_PATH at your GroupDocs.Total.lic. Works offline.
Metered (pay-per-use) — set both GROUPDOCS_METERED_PUBLIC_KEY and GROUPDOCS_METERED_PRIVATE_KEY. You are billed for what you actually process, which suits AI agents well because their usage is bursty and hard to predict up front. If both a metered key pair and a license file are configured, metered wins and the file is ignored.
Metered mode needs outbound connectivity. Usage is reported to GroupDocs servers, so air-gapped or firewalled deployments must allow that egress — or use a license file instead.
Call the `get_license_status` tool at any time to see which mode is active, and — under metered — the consumed quantity and remaining credit.
The metered private key is a secret. MCP client configs are plain files on disk, and a project-scoped .mcp.json is committed by convention, so prefer, in order:
stdio MCP server inherits its client's environment, so this works in every client. On macOS note that an app launched from Finder does not inherit shell exports — use launchctl setenv, or launch the client from a terminal.
${VAR};VS Code uses ${env:VAR} and ${input:...}).
~/.claude.json) is acceptable for asingle developer.
.mcp.json.For Docker, forward the values without writing them into any file:
docker run --rm -i \
-e GROUPDOCS_METERED_PUBLIC_KEY -e GROUPDOCS_METERED_PRIVATE_KEY \
-v /path/to/documents:/data \
ghcr.io/groupdocs-watermark/watermark-net-mcp:latestTo lift the limits with a license file:
| Variable | Description | Default |
|---|---|---|
GROUPDOCS_MCP_STORAGE_PATH | Base folder for input and output files | current directory |
GROUPDOCS_MCP_OUTPUT_PATH | (Optional) separate folder for output files | GROUPDOCS_MCP_STORAGE_PATH |
GROUPDOCS_LICENSE_PATH | Path to GroupDocs license file. In evaluation mode, output documents may include an additional evaluation watermark alongside the user-requested one | (evaluation mode) |
GROUPDOCS_METERED_PUBLIC_KEY | Metered public key. Requires the private key too; takes precedence over the license file | (unset) |
GROUPDOCS_METERED_PRIVATE_KEY | Metered private key. Secret - see Licensing | (unset) |
{
"mcpServers": {
"groupdocs-watermark": {
"type": "stdio",
"command": "dnx",
"args": ["GroupDocs.Watermark.Mcp", "--yes"],
"env": {
"GROUPDOCS_MCP_STORAGE_PATH": "/path/to/documents"
}
}
}
}To pin to a specific version, replace"GroupDocs.Watermark.Mcp"with"[email protected]"inargs. Pinning is recommended for shared / committed configs to avoid surprise upgrades.
NuGet.org generates a ready-to-use mcp.json snippet on the package page. Copy it directly into your .vscode/mcp.json.
Alternatively, add manually to .vscode/mcp.json:
{
"inputs": [
{
"type": "promptString",
"id": "storage_path",
"description": "Base folder for input and output files.",
"password": false
}
],
"servers": {
"groupdocs-watermark": {
"type": "stdio",
"command": "dnx",
"args": ["GroupDocs.Watermark.Mcp", "--yes"],
"env": {
"GROUPDOCS_MCP_STORAGE_PATH": "${input:storage_path}"
}
}
}
}Same pinning rule as above — swap"GroupDocs.Watermark.Mcp"for"[email protected]"to lock to a specific release.
cd docker
docker compose upEdit docker/docker-compose.yml to point volumes at your local documents folder.
Step-by-step deployment guides and a published-package integration test suite live in the companion repo GroupDocs.Watermark.Mcp.Tests:
dnx, global tool, pinned vs always-latestThat repo also exercises every advertised tool against the published NuGet artifact on Linux, macOS, and Windows in CI — so the snippets above are verified end-to-end on every release.
MIT — see LICENSE
<!-- mcp-name: io.github.groupdocs-watermark/groupdocs-watermark-mcp -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.